| name | threat-model-reviewer |
| description | Apply systematic threat modeling review when user designs systems, evaluates security architectures, or analyzes attack surfaces. Trigger when user mentions "threat model", "security review", "attack surface", "STRIDE", "trust boundary", or asks about potential threats. Use structured methodology to identify threats, assess risks, and recommend mitigations. |
| allowed-tools | Read, Grep, Glob, WebSearch |
Threat Model Reviewer
Systematically identify, classify, and prioritize threats using STRIDE framework.
Trigger Conditions
Activate: Designs systems with security implications, asks about threats, mentions "threat model", "attack surface", "what could go wrong"
Skip: Specific bugs (→ systematic-debugger), general concepts without specific system, compliance checklists
STRIDE Framework
| Category | Question | Examples |
|---|
| Spoofing | Can identity be faked? | Credential theft, session hijacking |
| Tampering | Can data be modified? | MITM, SQL injection |
| Repudiation | Can actions be denied? | Missing audit logs |
| Info Disclosure | Can data leak? | Verbose errors, insecure storage |
| Denial of Service | Can service be disrupted? | Resource exhaustion, DDoS |
| Elevation of Privilege | Can permissions exceed? | Privilege escalation, IDOR |
Risk Matrix
| Likelihood | Low Impact | Medium | High |
|---|
| High | Medium | High | Critical |
| Medium | Low | Medium | High |
| Low | Low | Low | Medium |
Steps
- Understand: Map components, data flows, trust boundaries, sensitive assets
- Identify: Apply STRIDE to each component/flow
- Assess: Score likelihood × impact, prioritize risks
- Mitigate: Recommend controls (Prevent, Detect, Respond, Recover)
Output Format
## System Understanding
**Components**: [List with trust levels]
**Trust Boundaries**: [What they separate]
**Sensitive Assets**: [Location, sensitivity]
## Threat Identification
### [Component]
- T1: [Threat] - [Scenario] - Current mitigation: [X]
## Risk Assessment
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| T1 | [name] | High | High | Critical |
## Mitigations
**T1**:
- Prevent: [Control]
- Detect: [Monitoring]
- Effort: [Low/Med/High]
Don't
- Skip threat identification for "simple" systems
- Assume cloud/framework handles all security
- Mark all risks as "critical" (dilutes prioritization)
- Ignore supply chain and third-party risks
- Create threat model once and never update
